---
title: "Tokenize card details"
method: POST
path: "/token/{clientId}"
tags: ["Tokenization"]
---

# Tokenize card details

`POST /token/{clientId}`

## Request

- Base URL: `https://vault.sandbox.payall.com`
- URL: `https://vault.sandbox.payall.com/token/{clientId}`
- Auth: none required

Tokenize provided card details.
Returns a token that can be used to reference the card
in other API methods.

Calling this endpoint directly means handling and encrypting card data on your side,
which requires a valid PCI DSS certification. Without one, use the
[PCI Vault iframe](#tag/pci-vault-iframe): it collects and encrypts the card for you
and calls this endpoint itself.

This endpoint is not idempotent.

Card number needs to be stripped of any non-digit characters before encrypting.
Expected pattern match is `^[1-9][0-9]{7,19}$`.

We recommend validating the card number with the Luhn algorithm before encrypting it.

We don't do card brand validation during this call.
Any brand will be accepted by the vault but the payment may fail
if the token is used for a payment with a vendor that does not support given brand.

## Path parameters

- `clientId` string, uuid, required

## Request body

- CardDetails
  - `card_number` string, required: Encrypted card number using client public key. Card number needs to be stripped of any non-digit characters before encrypting. Expected pattern match is `^[1-9][0-9]{7,19}$`. We recommend validating the card number with the Luhn algorithm before encrypting it.
  - `expiration_date` string: ISO/EIC 7813 Expiration date of the card

## Response `200`

OK

- TokenMetadata
  - `token` string, uuid: Token representing the card.
  - `created_at` string, date-time: Date and time when the token was created.
  - `masked_pan` string: Masked card number that is safe to use outside of the vault.
  - `client_id` string, uuid: ID of the client that owns the token.
  - `brand` 'Unknown' | 'Visa' | 'MasterCard' | 'AmericanExpress' | 'Discover' | 'MIR' | 'UnionPay' | 'RuPay' | 'DinersClub' | 'Maestro' | 'JCB' | 'UATP': Brand of the card based on 4 leading digits of the card.

## Other responses

- `400`: Input data validation error. See error code and message for details.
- `404`: Invalid id supplied

---

[API](https://skmtc.dev/payall/apis/payall-m2m-authentication-api.md) - [All operations](https://skmtc.dev/payall/apis/payall-m2m-authentication-api/llms.txt) - [OpenAPI document](https://skmtc.dev/payall/apis/payall-m2m-authentication-api/revisions/5f561eccd6ce?raw)